Deployment Architecture

how do you programmatically bump a search head?

cphair
Builder

Is there a Splunkish way (via curl or rest or something) to do the equivalent of clicking the bump button on the _bump page? It seems silly to write a script that has to generate the button click directly from that page.

Tags (2)
0 Karma

schose
Builder

Hi,

i created a custom search command | dobump. Feel free to test it out and give feedback.

https://github.com/schose/TA-dobump

Cheers,

Andreas

C_HIEN
Path Finder

Nice ! Thank you

0 Karma

David
Splunk Employee
Splunk Employee

I was just able to do this with Javascript in a Splunk dashboard. Here's the code if anyone would like it:

function doBump(){
    $.ajax({
        url: '/en-US/_bump',
        type: 'GET',
        async: false,
        success: function(returneddata) { 
            let baseBump = returneddata; 
            let postValue = $(baseBump).find("input[type=hidden]").val();
            //console.log("Initial Bump Page", returneddata);
            $.ajax({
                url: '/en-US/_bump',
                type: 'POST',
                data: "splunk_form_key=" + postValue,
                async: false,
                success: function(returneddata) { 
                                       // console.log("Final Bump", returneddata); 
                                },
                error: function(xhr, textStatus, error) { 
                                       // console.error("Error Updating!", xhr, textStatus, error);
                            })
        },
        error: function(xhr, textStatus, error) { 
                           // console.error("Error Updating!", xhr, textStatus, error);
                    }
    })
}
Tags (1)

javiergn
SplunkTrust
SplunkTrust

If you capture the HTTP requests generated when you press the bump button you can get the POST headers which I think you could probably use to replicate this behaviour via curl. I personally use the Live HTTP Headers extension to do that:

https://chrome.google.com/webstore/detail/live-http-headers/iaiioopjkcekapmldfgbebdclcnpgnlo?hl=en
https://addons.mozilla.org/en-GB/firefox/addon/live-http-headers/

You could also try to run a refresh for just those components that you've changed. See this post.

Hope that helps.

0 Karma

cphair
Builder

This is for JS and CSS specifically, so I don't think there's an endpoint for those components. I'll see if I can hack the POSt headers.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...